You got to treat those 12 words like they are the keys to life itself, nobody should
know them.
Can a BitCoin expert please confirm this:
This is for Online exchanges ONLY
I assume nothing can ever hack my bitcoins I have on a USB drive not connected to any network
This is wrong. All wallets are the same, the difference is where its being used from (a remote server vs your own pc). Online wallets often do NOT give you the privkey (seed words). When they do, they are being very nice and transparent but this is seldom the case (Some DEX do).
The money is not in the wallet. It NEVER is. The money is always in the "cloud", so called blockchain (this is also the reason Bitcoin isn't in any specific country but in all). The wallet is the key that allows its owner to move them. If you have the seed words you can recreate this key anywhere at anytime. Therefore these seed words need to be protected the most, and preferably should not see an electronic (hot) device ever. That is the point of writing it in a piece of paper with your own hands vs an usb thumb that needs to be plugged at some point (copy paste, printing, screen shooting and taking picture should be also avoided).
Truly the word wallet is a bit of a misnomer, maybe something like keyring would be more accurate, but i guess its easier for the masses.
You can create and recreate a wallet in a secure computer not connected to the internet, that loses its memory once turned off (a live iso such as Linux Tails OS), and manually broadcast generated transactions from a connected computer. A paper with words is truly "unhackable" as long as its kept (physically) safe. Preferably you would manually hand-write copy this into another paper and store it securely at a different physical location, in case something happens to the first one.
With the seed words you can recreate the wallet even if you lose it. The password is not used, but its important to keep the wallet encrypted while "hot" (in use).
The seed words could be theoretically saved in an encrypted text file in an usb thumb, but you'd better not lose the password... And remember that handling that is the most risky part, certainly don't use a windows computer connected to the internet...